# How to ignore previous log files when using file input plugin?

**URL:** https://discuss.elastic.co/t/how-to-ignore-previous-log-files-when-using-file-input-plugin/25940
**Category:** Logstash
**Created:** [July 20, 2015, 6:57pm UTC](https://discuss.elastic.co/t/how-to-ignore-previous-log-files-when-using-file-input-plugin/25940 "2015-07-20T18:57:11Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![nathaniel](https://avatars.discourse-cdn.com/v4/letter/n/ba8739/32.png) [@nathaniel](https://discuss.elastic.co/u/nathaniel)
#### Post date: [July 20, 2015, 6:57pm UTC](https://discuss.elastic.co/t/how-to-ignore-previous-log-files-when-using-file-input-plugin/25940/1 "2015-07-20T18:57:11Z")

</div>

Hi guys, I am a newbie in logstash. I am trying to forward all my log files to elasticsearch using logstash. The problem is, the previously existing log files are huge and I do not need them. Is there a way to only input the newly generated log files?

To make it clear, I did tried to set the start\_position =\> "end", and sincedb\_path =\> "/dev/null". It did not work. Hope you guys can help me figure it out.

Thanks in advance.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [July 20, 2015, 9:36pm UTC](https://discuss.elastic.co/t/how-to-ignore-previous-log-files-when-using-file-input-plugin/25940/2 "2015-07-20T21:36:42Z")

</div>

First of all, don't set `sincedb_path` to /dev/null. Logstash does a pretty good job at keeping track of where it left off. Don't sabotage that.

With `start_position => "end"` Logstash should under no circumstances process a file from the beginning. Please show your configuration. Also, increasing logging verbosity by starting Logstash with `--verbose` or `--debug` should give hints about what Logstash is doing.

---

<div class="post-metadata">

### Author: ![talevy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/talevy/32/44896_2.png) [@talevy](https://discuss.elastic.co/u/talevy)
#### Post date: [July 20, 2015, 10:51pm UTC](https://discuss.elastic.co/t/how-to-ignore-previous-log-files-when-using-file-input-plugin/25940/3 "2015-07-20T22:51:56Z")

</div>

You can take a look at the `exclude` configuration option. So you can  
exclude the existing files from being processed.

more info here: [https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-exclude](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-file.html#plugins-inputs-file-exclude)

---

<div class="post-metadata">

### Author: ![metload](https://avatars.discourse-cdn.com/v4/letter/m/85f322/32.png) [@metload](https://discuss.elastic.co/u/metload)
#### Post date: [September 5, 2016, 6:24pm UTC](https://discuss.elastic.co/t/how-to-ignore-previous-log-files-when-using-file-input-plugin/25940/4 "2016-09-05T18:24:46Z")

</div>

Hi Magnus,

If you don't recommend to set sincedb\_path to "dev/null", How can I be able to read the file of the beginning?,

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [September 5, 2016, 6:44pm UTC](https://discuss.elastic.co/t/how-to-ignore-previous-log-files-when-using-file-input-plugin/25940/5 "2016-09-05T18:44:21Z")

</div>

> If you don't recommend to set sincedb\_path to "dev/null",

Not under the circumstances described above...

> How can I be able to read the file of the beginning?,

...but your circumstances are the exact opposite.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:39am UTC](https://discuss.elastic.co/t/how-to-ignore-previous-log-files-when-using-file-input-plugin/25940/6 "2017-07-06T04:39:49Z")

</div>


